Thanks for rehashing about everything I wrote here or in the posts I linked to.


I already addressed /var/log/secure and equivalent in my second post.


Given a correct understanding of the requirements and the way available tools match or not, the choice for selecting something less than the optimal simply becomes a question of competence.

I do agree "the choice for selecting something less than the optimal simply becomes a question of competence".

Tools are created by us,many bugs are opened and fixed. The method always need improvisation.New idea always be appreciated so that anyone can modify and make it better.We can not 100% judge it is less than optimal,they also have some advantages.

Awesome! it was very nice discussion and explanation by every participant in this post. I do really appreciate all, who spent some time to look in to the issue and explained. I will try using sudo, rootsh and the logging method suggested by sharadchhetri and then decide which one is good for my working environment. Of-course, I have to convince others as well

unSpawn, Thank you very much for your help

Once again thanks all of you guys

NP, you're welcome. After all helping is what we're here for.


What matters is the reason for changing this. I mean that if you don't have the luck to be able to use say regulatory compliance as an argument then you only have company or institutions (network) policies if any, security best practices and increased cost of maintenance if the audit trail remains broken. So what you could do is quantify as you know that's what managers need to make a decision. If like you said it's a legacy thing then trying to wean users off bad habits will be met with resistance no matter what you do. What you could do is log all access, tally how different roles use the server and devise solutions that take away their common "ease of use" and related arguments.

1 members found this post helpful.

Maybe you can't but I can. Having had to reconstruct time lines from broken audit trails on compromised servers a couple of times taught me that. All I can do is try to pass what I've learned on to others.

Thanks for sharing your questions and the loopholes you highlighted . It was really a good discussion. Securing the server and make robust auditing should always be in priority . loopholes are in almost all tool or method, we have to just fill it up and improvise it with our real time scenario problems.